Does every security incident involve a forensic investigation?

Not all infected computers will require full-scale forensic examination by the University Information Security Office. Systems unlikely to contain Level 1 protected data will not require preemptive forensics work, which involves the removal of the physical machine to a separate facility for detailed investigation. For security reasons, we can't go into any further details about what happens after that.